Re: Bug in FindBugs?

Oakes, Jeff (HTSC, IT) wrote:
> I ran findBugs against some education example code.  The following 
> code was flagged as putting the collection at risk.
>
> *private* *static* *final* String[] /Salutations/ = {
>
>     // These are the valid set of Salutations
>
>     "Mr.", "Master", "Miss", "Mademoiselle", "Madame",
>
>     "Messieure", "Mrs.", "Ms.", "President",
>
>     "Vice President", "Secretary", "Treasurer", "Dr."
>
> };
>
> *public* *static* String[] getSalutations(){
>
> *    return* /Salutations/;
>
> }
>
> Given that the collection is final, and the members are strings 
> (immutable), i do not see where this puts the collection at risk.  
> Have I missed something?
Yes:

String s[] = SalutationsClass.getSalutations();
s[0] = "Doughhead";

That last line just modified the salutation for everybody that has 
called or will call getSalutations. Making Salutations final just means 
nothing else in that class can assign to that variable, it doesn't 
protect what the variable references. You need to return a copy of the 
array.

Brian